IC card and IC chip module

ABSTRACT

In an IC card  30  is sealed an IC chip  70  provided with an exposure sensor  84 . When exposure sensor  84  detects that IC card  30  has been opened, exposure sensor  84  outputs an exposure detection signal to a CPU  76 . In response to the exposure detection signal, CPU  76  provides a predetermined operation, such as erasure of data in a non-volatile memory  78 . As such, the data in non-volatile memory  78  cannot be obtained if IC card  30  is improperly opened to check the data in non-volatile memory  78 . Thus the IC card can obtain an enhanced data security.

TECHNICAL FIELD

The present invention relates to IC cards and IC chip modules and inparticular to IC cards and IC chip modules with enhanced security.

BACKGROUND ART

A communication system employing a non-contact IC card is used forautomatic ticket-gates of ski lifts, railroads and the like, automaticfreight-sorting, and the like. FIG. 15 is a perspective view showing oneexample of a conventional non-contact IC card. An IC card 2 shown inFIG. 15 is a 1-coil IC card comprised of a coil 4 used as an antenna,capacitors C1 and C2, and an IC chip 8.

Capacitors C1, C2 and IC chip 8 are mounted to a synthetic resinsubstrate in the form of a film. The substrate with capacitors C1, C2and IC chip 8 mounted thereto is referred to as a tape automated bonding(tab) 10.

FIG. 16A is a cross section of the FIG. 15 IC card 2 taken along lineS1—S1. In the figure, a core member 12 of synthetic resin is sandwichedby paired surface members 14 and 16. Tab 10 with capacitors C1, C2 andIC chip 8 mounted thereto is fixed to surface member 14 exposed in acavity 18 provided in core member 12. A joint of tab 10 and IC chip 8 iscovered with a sealing agent 9 such as epoxy resin. Coil 4 is arrangedbetween surface member 14 and core member 12. Coil 4 and tab 10 areconnected together via a wire 20.

FIG. 16B is a circuit diagram of IC card 2. Referring to the figure, inIC card 2 an electromagnetic wave sent from a reader/writer (aninterrogator (not shown)) is received at a resonator circuit 22configured of coil 4 and capacitor C1 and it is used as a power supply.It should be noted that capacitor C2 is a power smoothing capacitor.

Furthermore, information superimposed on the electromagnetic wave andthus sent therewith is decrypted by a control unit (not shown) providedin IC chip 8. The control unit then rewrites a content of a non-volatilememory (not shown) provided in IC chip 8, makes a response to thereader/writer, and the like. The response is made by varying animpedance of resonator circuit 22. The reader/write obtains the contentof the response by detecting an impedance variation (an impedancereflection) of its resonator circuit (not shown) that is associated withthe impedance variation of IC card 2 resonator circuit 22.

As such, IC card 2 does not require an internal power supply and alsoallows non-contact communication of data.

However, conventional IC card 2 has the following disadvantage: inconventional IC card 2, a pad (or a terminal) (not shown) used forchecking the performance of a mounted non-volatile memory or the like inthe process for manufacturing the same is provided on a surface of ICchip 8. As such, the pad is exposed when surface members 14, 16 areremoved. By applying a probe (an inspecting needle) on the exposed pad,the data in the non-volatile memory can readily be read and IC chip 8can be operated. That is, the conventional IC card does not have highdata security. Furthermore, as shown in FIG. 17, there is also an ICcard which mounts to tab 10 two IC chips, i.e., an IC chip 6 with acontrol unit (not shown) and an IC chip 7 with a non-volatile memory(not shown). In such a type of IC card, in addition to the pad mentionedabove a wire 24 connecting two IC chips 6 and 7 together is alsoexposed, which further facilitates reading the data stored in thenon-volatile memory.

The present invention has been made to overcome the above disadvantagesand contemplates an IC card and IC chip module with enhanced datasecurity.

DISCLOSURE OF THE INVENTION

To achieve the above object, in one aspect of the present invention anIC card is comprised of an IC chip provided with an IC circuit, ahousing body disposed to house the IC chip, and an exposure detectionunit disposed to detect opened condition of the housing body,characterized in that when the exposure detection unit detects that thehousing body has been opened the IC chip at least partially fails tonormally operate.

As such, when the housing body housing the IC card is opened the ICcircuit does not operate normally. Thus, if the IC card is improperlyobtained and opened, it is extremely difficult to find the function ofthe IC card. Thus the IC card can obtain an enhanced data security.

Preferably the IC circuit includes a data storage unit disposed to storedata wherein once the exposure detection unit detects the openedcondition the data storage unit has the data at least partially renderednon-extractable.

As such, once the IC card has been opened the data storage unit has thedata at least partially rendered non-extractable. Thus it is extremelydifficult to obtain important data when the IC card is improperlyopened.

Still preferably, the data storage unit has the data at least partiallyprohibited from being read once the exposure detection unit detects theopened condition.

As such, the data in the data storage unit cannot be read ones thehousing body housing the IC card has been opened. The IC card may alsobe conveniently configured to allow the data to be read through aparticular process if a party concerned does not want a third party toobtain the data but wants to keep the data.

Still preferably in the IC card the data storage unit has the data atleast partially erased once the exposure detection unit detects theopened condition.

As such, once the housing body housing the IC card has been opened thedata storage unit has the data at least partially erased. Thus, once thehousing body has been opened no one can obtain the data. Thus the ICcard can be provided with an extremely enhanced data security.

Still preferably, the IC card is comprised of a data processing unitdisposed to process data wherein the data processing unit has a functionat least partially stopped once the exposure detection unit detects theopened condition.

As such, the data processing unit has a function at least partiallyfailing to function once the housing body housing the IC card has beenopened. Thus, it is extremely difficult to know the function of the dataprocessing unit if the IC card is improperly obtained and opened.

Preferably the exposure detection unit detects the opened condition bydetecting external light entering when the housing body is opened.

As such, the opened condition can readily be detected, e.g., via a lightreceiving element arranged in the housing body.

Still preferably, as the exposure detection unit a plurality of lightreceiving elements are arranged in parallel.

For example, a plurality of small light-receiving elements may bearranged in the housing body to less noticeably arrange the elements.The plurality of light receiving elements can also be dispersedlyarranged to detect the opened condition over a wide range of area.

Still preferably, the exposure detection unit detects the openedcondition by detecting a variation in electrostatic capacitance that isintroduced when the housing body is opened.

As such, the opened condition can be detected, e.g., if a capacitordefined by at least a portion of the housing body has an electrostaticcapacitance varying when the housing body is opened.

Still preferably, the exposure detection unit detects the openedcondition by detecting a variation in resistance that is introduced whenthe housing body is opened.

As such, the opened condition can be detected, e.g., if a resistordefined by at least a portion of the housing body has a value ofresistance that varies when the housing body is opened.

Still preferably, the exposure detection unit detects the openedcondition by detecting disconnection of a predetermined interconnectionthat is caused when the housing body is opened.

As such, the opened condition can be detected, e.g., if aninterconnection arranged at at least a portion of the housing body isadapted to be disconnected when the housing body is opened.

In another aspect of the present invention, an IC chip module with atleast two members integrally formed is comprised of an IC circuitprovided at at least one of the members, characterized in that there isprovided a exposure detection unit detecting opened condition of the ICchip module, wherein once the exposure detection unit detects the openedcondition the IC circuit at least partially fails to normally function.

Preferably, the IC circuit includes a data storage unit disposed tostore data, wherein once the exposure detection unit detects the openedcondition the data storage unit has the data at least partially renderednon-extractable.

Still preferably, the data storage unit has the data at least partiallyprohibited from being read once the exposure detection detects theopened condition.

Still preferably, the data stored in the data storage unit is partiallyerased once the exposure detection unit detects the opened condition.

Still preferably, the IC circuit includes a data processing unit havinga function at least partially stopped once the exposure detection unitdetects the opened condition.

Still preferably, the exposure detection unit detects the openedcondition by detecting external light entering when the IC chip moduleis opened.

Still preferably, the exposure detection unit is a plurality of lightreceiving elements arranged in parallel.

Still preferably, the exposure detection unit detects the openedcondition by detecting a variation in electrostatic capacitance that isintroduced when the IC chip module is opened.

Still preferably, the exposure detection unit detects the openedcondition by detecting a variation in a value of resistance that isintroduced when the IC chip module is opened.

Still preferably, the exposure detection unit detects the openedcondition by detecting disconnection of a predetermined interconnectionthat is caused when the IC chip module is opened.

Still preferably, the exposure detection unit is at least partiallydefined by a portion of the IC chip circuit provided in the IC chip.

As such, the exposure detection unit is hardly recognized in thegeometry of the IC chip, resulting in an enhanced data security.Furthermore, incorporating a portion or the entirety of the exposuredetection unit into the IC chip in fabricating the IC chip can reducethe cost for manufacturing the IC card or the IC chip module.

Still preferably, the exposure detection unit detects the openedcondition via a light receiving element detecting external lightentering when the housing body is opened, wherein the light receivingelement is defined by a portion of the IC circuit provided in the ICchip.

As such, a light receiving element such as a photodiode readily formedusing the IC circuit, can be used to readily incorporate the exposuredetection unit. It is also convenient if a plurality of small lightreceiving elements are dispersedly incorporated, since such lightreceiving elements are further hardly recognized in the geometry of theIC chip.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a perspective view of a geometry of an IC card 30 according toa first embodiment of the present invention.

FIG. 2 shows a main cross section of the FIG. 11C card 30 taken alongline S2—S2.

FIG. 3 shows a circuit configuration of IC card 30.

FIG. 4 is a circuit diagram showing a specific example of a exposuresensor 84.

FIG. 5A is a main cross section of IC card 30 with exposure sensor 84 ina first modification of the present invention, and FIG. 5B is a circuitdiagram of exposure sensor 84 therein.

FIG. 6A is a main cross section of IC card 30 with exposure sensor 84 ina second modification of the present invention, and FIG. 6B is a circuitdiagram of exposure sensor 84 therein.

FIG. 7 is a flow chart representing an exemplary process executed by aCPU 76 when IC card 30 is opened.

FIG. 8 is a flow chart representing a first modification of the processexecuted by CPU 76 when IC card 30 is opened.

FIG. 9 is a flow chart representing a second modification of the processexecuted by CPU 76 when IC card 30 is opened.

FIG. 10A is an exploded perspective view of an IC chip module 92 in asecond embodiment of the present invention, and FIG. 10B is a circuitdiagram of exposure sensor 84 therein.

FIG. 11A is an exploded perspective view of an IC chip module 98 in athird embodiment of the present invention, and FIG. 11B is a circuitdiagram of exposure sensor 84 therein.

FIG. 12 shows a configuration of an IC card with exposure sensor 84provided internal to an IC chip.

FIGS. 13A and 13B are an exemplary planar configuration and a main crosssection, respectively, of an IC chip 70 when an IC circuit is partiallyused to configure a photodiode.

FIGS. 14A and 14B are a variation of a planar configuration and a maincross section thereof, respectively, of IC chip 70 when an IC circuit ispartially used to configure a photodiode.

FIG. 15 shows one example of a conventional, non-contact IC card.

FIG. 16A is a cross section taken along line S1—S1 of FIG. 15, and FIG.16B is a circuit diagram of an IC card 2.

FIG. 17 shows another exemplary, conventional, non-contact IC card.

BEST MODES FOR CARRYING OUT THE INVENTION

The present invention will now be described in detail with reference tothe drawings.

First Embodiment

FIG. 1 shows a configuration of an IC card 30 in a first embodiment ofthe present invention. In the figure, IC card 30 is a 1-coil IC cardwhich can be used in conjunction with pre-paid cards, automaticticket-gates of ski lifts, railroads and the like, automaticfreight-sorting, and the like.

FIG. 2 is a main cross section of the FIG. 11C card 30 (taken along lineS2—S2). IC card 30 has a surface member 32, a core member 34 and asurface member 36 that are stacked successively. Surface members 32, 36are formed of synthetic resin, such as vinyl chloride, polyethyleneterephthalate, (PET). Core member 34 is formed of synthetic resin.Surface members 32, 36 and core member 34 define a housing body.

A cavity 38 is provided in a layer formed by core member 34. In cavity38 are arranged an IC chip 70, a tape automated bonding (tab) 40 with amounted capacitor C configuring a resonator circuit 80 (shown in FIG.3), and other components. Tab 40 is fixed to surface member 32. A jointof tab 40 and IC chip 70 is covered with a sealing agent 42 such asepoxy resin. An antenna 82 is arranged between surface member 32 andcore member 34. Antenna 80 and tab 40 are connected together via a wire44.

Furthermore, as shown in FIG. 1, photodiodes D1, D2, D3, D4 as lightreceiving elements and a resistor R1 are mounted to tab 40. PhotodiodesD1-D4 and resistor R1 configure a exposure sensor 84 described later(shown in FIG. 3).

It should be noted that cavity 38 shown in FIG. 2 may be filled withsynthetic resin or the like. As such, the synthetic resin is alsocontained in the housing body described above. Furthermore, one or bothof surface members 32 and 36 may be dispensed with if cavity 38 isfilled with synthetic resin or the like.

FIG. 3 is a block diagram showing a circuit configuration of IC card 30and an interrogator 50. Interrogator 50 is controlled by a control unit54 to send a radio frequency (RF) carrier wave from an oscillatorcircuit (OSC) 60 via an antenna 58. When IC card 30 approachesinterrogator 50, the RF carrier wave is received by IC card 30 antenna82. A power supply generator circuit 72 converts the received RF waveinto a direct-current electrical power and supplies the power to othercomponents. As such, IC card 30 becomes operable when it approachesinterrogator 50.

To transmit information from interrogator 50 to IC card 30, control unit54 controls a modulator/demodulator circuit 52 to modulate a RF carrierwave. In IC card 30, a modulator/demodulator circuit 74 demodulates themodulated RF carrier wave. A CPU 76 as a data processing unit obtainsthe demodulated information and thus rewrites a content of anon-volatile memory 78 serving as a data storage unit, returnsinformation, and provide other necessary operations.

On the other hand, IC card 30 also transmits information to interrogator50. It should be noted that IC card 30 does not have an oscillatorcircuit. Accordingly, interrogator 50 is adapted to send a RF carrierwave which is not modulated and IC card 30 is adapted to havemodulator/demodulator circuit 74 varying an impedance of a resonatorcircuit 80. In interrogator 50, modulator/demodulator circuit 52 detectsthe impedance variation as that of resonator circuit 56 and demodulatesit. Control unit 54 obtains the demodulated information and accordinglyprovides necessary operations.

When IC card 30 is moved away from interrogator 50, IC card 30 loses itspower supply and thus stops operating. However, IC card 30 hasnon-volatile memory 78 and can thus maintain the information storedtherein if IC card 30 loses its power supply.

A exposure sensor 84, configuring an exposure detection unit, outputs anexposure detection signal to CPU 76 when exposure sensor 84 detects thatsurface member 32, 36 (shown in FIG. 2) has been removed. In response tothe exposure detection signal, CPU 76 performs a predeterminedoperation, such as erasure of data stored in non-volatile memory 78.

FIG. 4 is a circuit diagram showing a specific example of exposuresensor 84. Exposure sensor 84 is configured by four photodiodes D1-D4connected in parallel and a resistor R1 connected in series tophotodiodes D1-D4. Exposure sensor 84 receives a power supply voltage Efrom a power supply generator circuit 72 (shown in FIG. 3). Exposuresensor 84 has two output terminals Ts connected to CPU 76 (shown in FIG.3).

The voltage across to output terminals Ts is set to have a value no morethan a predetermined threshold when any of photodiodes D1-D4 does notreceive light. It is also set to have a value no less than the thresholdwhen any of photodiodes D1-D4 receives light.

Normally, as shown in FIG. 2, photodiodes D1-D4 are arranged in cavity38 sealed by surface members 32, 36 and core member 34. Thus the voltageacross two output terminals Ts has a value no more than the threshold.When IC card 30 is opened, e.g. by removing surface member 36, lightenters cavity 38 and is thus received by any of photodiodes D1-D4. Thusthe voltage across two output terminals Ts rises to a value no less thanthe threshold. The voltage created across two output terminals Ts thathas a value no less than the threshold corresponds to the exposuredetection signal described above.

The present example is adapted to provide a voltage across two outputterminals Ts that has a value no less than a threshold when any ofphotodiodes D1-D4 receives light. However, it may be adapted to providea voltage across two output terminals Ts that has a value no less thanthe threshold when at least two, at least three or all of photodiodesD1-D4 receive light, so that photodiodes D1-D4 may individually have asmall capacity and can thus be hardly recognized.

While in the present example four photodiodes D1-D4 are arranged inparallel, any number of photodiodes may be connected in parallel. Only asingle photodiode may also be used.

Furthermore, while in the present example a photodiode is used as alight detecting means, a phototransistor may be alternatively used asthe light detecting means. It should be noted that the technique ofdetecting external light to detect the exposure is not limited to thecircuit described above.

FIGS. 5A and 5B illustrate a first modification of exposure sensor 84.FIG. 5A shows a main cross section of IC card 30 with exposure sensor 84in the first modification. FIG. 5B is a circuit diagram of exposuresensor 84.

As shown in FIG. 5B, exposure sensor 84 is configured of two resistorsR2 and R3 connected in series. As is similar to the example shown inFIG. 4, exposure sensor 84 receives power supply voltage E from powersupply generator circuit 72 and has two output terminals Ts connected toCPU 76.

As shown in FIG. 5A, an electrode 46 is fixed on an internal side ofsurface member 32 and an electrode 48 is fixed on an internal side ofsurface member 36. Core member 34 between electrodes 46 and 48 isadapted to have a predetermined electrical resistance R2. Morespecifically, core member 34 corresponds to resistor R2 shown in FIG.5B. Electrodes 46 and 48 are connected to tab 40 via wires 62 and 64,respectively. Resistor R3 is arranged at tab 40, as appropriate (notshown).

The voltage across two output terminals Ts is set to have a value nomore than a predetermined threshold when the resistance betweenelectrodes 46 and 48 is equal to R2. It is also set to have a value noless than the threshold when the resistance between electrodes 46 and 48exceeds R2.

Normally, electrodes 46 and 48 adhere to core member 34, as shown inFIG. 5A. Thus the voltage across two output terminals Ts is no more thanthe threshold. However, if IC card 30 is opened, e.g., by removingsurface member 36, electrode 48 adhering to surface member 36 is removedfrom core member 34 and the resistance between electrodes 46 and 48 isthus extremely increased. Thus the voltage across two output terminalsTs exceeds the threshold. As is shown in the FIG. 4 example, the voltagedeveloped across two output terminals Ts that exceeds the thresholdcorresponds to the exposure detection signal described above. It shouldbe noted that the technique of detecting a resistance variation todetect the exposure is not limited to the circuit described above.

FIGS. 6A and 6B show a second modification of exposure sensor 84. FIG.6A is a main cross section of IC card 30 with exposure sensor 84 in thesecond modification. FIG. 6B is a circuit diagram of exposure sensor 84therein.

As shown in FIG. 6B, exposure sensor 84 is configured of a capacitor Csand a resistor R4 connected in series thereto. As is similar to eachexample above, exposure sensor 84 receives power supply voltage E frompower supply generator circuit 72 and has two output terminals Tsconnected to CPU 76.

As shown in FIG. 6A, electrode 48 adheres to an internal side of surfacemember 32 and electrode 48 to that of surface member 36. The FIG. 6Aexample is similar to the FIG. 5 example in that electrodes 46 and 48are connected to tab 40 via wires 62 and 64, respectively. It should benoted, however, that in exposure sensor 84 shown in FIG. 6, core member34 between electrodes 46 and 48 is adapted to have a predetermineddielectric constant. More specifically, electrodes 46 and 48 and coremember 34 configure capacitor Cs with a predetermined electrostaticcapacitance Cs. Resistor R4 is arranged at tab 40, as appropriate (notshown).

After power supply E ON, a voltage across two output terminals Tsattains a power supply voltage according to a time constant determinedby capacitor Cs and resistor R4. As such, with resistor R4 set to havean appropriate value, the voltage across two output terminals Ts is setto have a value no more than a predetermined threshold for electrostaticcapacitance Cs between electrodes 46 and 48 when a predetermined periodof time has elapsed since power-on. It is also set to have a value noless than the threshold for an electrostatic capacitance betweenelectrodes 46 and 48 that is smaller than Cs, e.g., for a reduced timeconstant when the predetermined period of time has elapsed sincepower-on.

Normally, electrodes 46 and 48 adhere to core member 34, as shown inFIG. 6. Thus, the voltage across two output terminals Ts has a value nomore than the threshold when the predetermined period of time haselapsed since power-on. However, when IC card 30 is opened, e.g., byremoving surface member 36, electrode 48 adhering to surface member 36is removed from core member 34 and also moved farther away fromelectrode 46 adhering to surface member 32. This results in anelectrostatic capacitance smaller than Cs between electrodes 46 and 48and hence a reduced time constant. As a result, the voltage across twooutput terminals Ts will have a value no less than the threshold whenthe predetermined period of time has elapsed since power-on. In thisexample, the voltage across two output terminals Ts that exceeds thethreshold when the predetermined period of time has elapsed sincepower-on, corresponds to the exposure detection signal described above.

It should be noted that the technique of detecting a variation inelectrostatic capacitance to detect the exposure is not limited to thecircuit described above. For example, the exposure may be detected bydetecting that variation in the resonance frequency of a resonatorcircuit, configured of a capacitor and a coil, which is attributed to avariation in the electrostatic capacitance of the capacitor.

It should be noted that although in each of the above embodiments,exposure sensor 84 is positioned external to IC chip 70, as shown inFIG. 3, exposure sensor 84 may be positioned at any other locations. Forexample, as shown in FIG. 12, exposure sensor 84 may be positionedinternal to IC chip 70. Furthermore, one portion of exposure sensor 84may be positioned internal to IC chip 70 and the other portion ofexposure sensor 84 external to IC chip 70.

Exposure sensor 84 partially or entirely located internal to IC chip 70can be less recognizable in the geometry of IC chip 70 to provide afurther enhanced data security. Incorporating a portion or the entiretyof exposure sensor 84 into IC chip 70 in fabricating IC chip 70, canalso reduce the cost for manufacturing IC card 30. It should also benoted that in the IC chip module described later, exposure sensor 84 maypartially or entirely be provided internal to an IC chip, as in IC card30.

FIGS. 13A and 13B partially show a configuration of IC chip 70 whenphotodiodes D1-D4 configuring the above-described exposure sensor 84(shown in FIG. 4) are formed of a portion of an IC circuit provided inIC chip 70. FIG. 13A schematically shows a planar configuration of ICchip 70. FIG. 13B is a main cross section of IC chip 70.

As shown in FIG. 13B, IC chip 70 has a p-type semiconductor substrate100 with multiple (in this example, 4) n well regions 102 formedtherein. Each n well region 102 has a p⁺ region 104. Each n well 102 andeach p⁺ region 104 configure a respective one of photodiodes D1-D4.

P⁺ regions 104 are mutually connected via an aluminum interconnection108 through a contact hole 106 a provided in an interlayer film 106.Similarly, n well regions 102 are mutually connected via an aluminuminterconnection 110 (shown in FIG. 13A). As such, aluminuminterconnections 108 and 110 connect four diodes D1-D4 in parallel. Theyare covered by a passivation film 112.

As has been described previously (referring to FIG. 2), when IC card 30is opened, e.g., by removing surface member 36, light transmittedthrough passivation film 112 and interlayer film 106 is received byphotodiodes D1-D4 formed close to a surface of IC chip 70. Thus aexposure detection signal is produced.

As described above, it is technically, relatively easy to formphotodiodes D1-D4 of a portion of an IC circuit provided in IC chip 70.Furthermore, it is convenient if such multiple small photodiodes areincorporated dispersedly, since the photodiodes are further hardlyrecognized in the geometry of IC chip 70.

It should be noted that while the FIGS. 13A and 13B example shows thatin p-type semiconductor substrate 100 a plurality of n well regions 102are formed corresponding to photodiodes D1-D4, in p-type semiconductorsubstrate 100 a single, common n well region 102 can be provided forphotodiodes D1-D4, as shown in FIGS. 14A and 14B, to conveniently reducethe length of aluminum interconnection 110.

An exemplary processing executed by CPU 76 when IC card 30 is openedwill now be described with reference to FIG. 3 or 12 and the FIG. 7 flowchart. As has been described above, IC card 30 does not have an internalpower supply. As such, if IC card 30 is opened with CPU 76 not inoperation, CPU 76 does not know that IC card 30 has been opened.

When a person who has opened IC card 30 desires to know CPU 76operation, obtain non-volatile memory 78 data or the like and finds apad for power supply (not shown) of exposed IC chip 70 and applies aprobe or the like on the pad to supply power to IC chip 70, then CPU 76is initiated (step S1).

After it is initiated, CPU 76 first checks whether exposure sensor 84has output the exposure detection signal (step S2). If the exposuredetection signal has not been received, CPU 76 operates normally.

If IC card 30 is open, exposure sensor 84 has already output theexposure detection signal, as has been described above. Accordingly, CPU76 erases all data stored in non-volatile memory 78 (step S3).

Once IC card 30 has been opened, the data in non-volatile memory 78 areall erased and no one can thus obtain the data. This can provide anextremely enhanced data security.

It should be noted that while in the present example the data innon-volatile memory 78 are all erased once IC card 30 has been opened,the data in non-volatile memory 78 may only partially be erased once ICcard 30 has been opened, to conveniently, selectively erase only thedata that must not be obtained by third parties while maintaining theother data.

FIG. 8 is a flow chart representing another specific, exemplaryprocessing executed by CPU 76 when IC card 30 is opened. The processuntil CPU 76 detects that IC card 30 has been opened (steps S11, S12) issimilar to that represented in the FIG. 7 example (steps S1, S2). In thepresent example, however, CPU 76 disables reading any of the data storedin non-volatile memory 78 once CPU 76 detects that IC card 30 has beenopened (step S13).

The present example is also distinguished from the FIG. 7 example inthat non-volatile memory 78 data that have been rendered unreadable canalso be re-read by applying a particular processing.

More specifically, CPU 76 monitors whether a predetermined pad (notshown) provided on IC chip 70 has received a predetermined enable signal(a read enable signal) (step S14). When the enable signal has beenreceived, CPU 76 again enables reading non-volatile memory 78 data (stepS15). Coding the enable signal can more or less prevent third partiesfrom reading the data.

It is convenient if opening IC card 30 disables reading any of the datain non-volatile memory 78 and applying a particular processing allowsthe data to be obtained, since the possibility that third parties obtainthe data can be reduced and the data can also be extracted later asrequired.

It should be noted that while in the present example, opening IC card 30disables reading any of the data in non-volatile memory 78, opening ICcard 30 may alternatively only disable reading a portion of the data innon-volatile memory 78.

In the above, inputting the enable signal again enables reading any ofthe non-volatile memory 78 data having been rendered unreadable. Incontrast, inputting the enable signal may again only enable reading aportion of non-volatile memory 78 data having been rendered unreadable.This is a preferable configuration in terms of data security because noone can read the data which absolutely should not be obtained by thirdparties.

FIG. 9 represents still another specific exemplary process provided byCPU 76 when IC card 30 is opened. The process until CPU 76 detects thatIC card 30 has been opened (steps S21, S22) is similar to that in eachspecific example above. In the present example, however, CPU 76 rendersitself inoperable once CPU 76 detects that IC card 30 has been opened(step S23).

Once IC card 30 has been opened, CPU 76 does not function. Thus, it isextremely difficult to find its data processing function if the IC cardor IC chip module is improperly obtained and opened.

As in the FIG. 8 example, in the present example also CPU 76 oncerendered non-operable can again be operated by applying a particularprocessing. More specifically, CPU 76 can again be operated only when apredetermined pad (not shown) provided on IC chip 70 receives apredetermined enable signal (a CPU operation enable signal) (steps S24,S25).

In the present example, opening IC card 30 disables the entire functionof CPU 76. In contrast, opening IC card 30 may stop only a portion ofthe CPU 76 function while not stopping the remainder of the CPU 76function. This is a convenient configuration since it can stop only theprocessing function(s) which should not be known to third parties whilenot stopping the other, general function(s).

In the present example, inputting an enable signal enables all of thefunctions of CPU 76 that have been stopped. In contrast, inputting theenable signal may again enable only a portion of the stopped CPU 76functions. This is a preferable configuration in terms of data securitybecause no one can obtain the processing function(s) which absolutelyshould not be known to third parties.

While the present example a stopped CPU 76 function is again enabled inresponse to a predetermined enable signal, it may be adapted to neveroperate again once it has been stopped.

Second Embodiment

FIG. 10A is an exploded perspective view of an IC chip module 92 in asecond embodiment of the present invention. IC chip module 92 isincorporated in an IC card used for pre-paid cards, automaticticket-gates for ski lifts, railroads and the like, automaticfreight-sorting, and the like.

IC chip module 92 is formed by bonding IC chips 86 and 88 to ananisotropic conductor 90. In the present embodiment, a CPU, amodulator/demodulator circuit, a power supply generator circuit andother main circuits (not shown) are mounted to IC chip 86, and anon-volatile memory (not shown) is mounted to IC chip 88. IC chip 86 hasan upper surface provided with a plurality of terminals 86 a, 86 b, . .. , and IC chip 88 has a lower surface provided with terminals 88 a, 88b, . . . positionally opposite to terminals 86 a, 86 b . . . .

Anisotropic conductor 90 is an adhesive conductor which is conductiveonly in one direction. It may be, for example, anisolum (available fromHitachi Chemical Co., Ltd.), a thermosetting adhesive. Such anisotropicconductor 90 allows IC chips 86 and 88 to firmly adhere thereto tothereby electrically connect together terminals 86 a, 86 b, . . . andterminals 88 a, 88 b, . . . positionally opposite to terminals 86 a, 86b, to form IC chip module 92.

Terminals 86 c, 86 d, . . . and terminals 88 c, 88 d, . . . that areelectrically connected together allow electrical connection between themain circuits provided in IC chip 86 and the non-volatile memoryprovided in IC chip 88. IC chip module 92 thus fabricated and aresonator circuit (not shown) including an antenna are sealed into ahousing body (not shown) to complete a non-contact IC card.

IC chip module 92 includes exposure sensor 84. FIG. 10B is a circuitdiagram of exposure sensor 84 in the present embodiment. As shown inFIG. 10B, exposure sensor 84 is configured by connecting aninterconnection 89 and a resistor R5 in series. Similar to each exposuresensor 84 described above (shown in FIG. 5B, for example), exposuresensor 84 receives power supply voltage E from a power supply generatorcircuit (not shown) provided in IC chip 86 and has two output terminalsTs connected to a CPU (not shown) provided in IC chip 86.

As shown in FIG. 10A, terminals 88 a and 88 b provided to IC chip 88 areelectrically connected together internal to IC chip 88 viainterconnection 89. As such, terminals 86 a and 86 b provided to IC chip86 are electrically connected together via anisotropic conductor 90,terminal 88 a, interconnection 89 and terminal 88 b. Resistor R5 shownin FIG. 10B is arranged in IC chip 86, as appropriate (not shown).

The voltage across two output terminals Ts is set to have a value nomore than a predetermined threshold when interconnection 89 allowsconduction between two output terminals Ts. It is also set to have avalue no less than the threshold when conduction (connection) failsbetween two output terminals Ts.

Normally, IC chips 8G and 88 are connected together via anisotropicconductor 90 and conduction is thus achieved between two outputterminals Ts. Thus the voltage across two output terminals Ts is no morethan the threshold. However, when IC chip module 92 is opened or ICchips 86 and 88 are separated from each other, conduction fails betweenterminals 86 a and 86 b and the voltage across two output terminals Tshas a value no less than the threshold. The voltage created across twooutput terminals Ts that has a value no less than the thresholdcorresponds to the exposure detection signal described above.

It should be noted that the technique of detecting disconnection of theinterconnection to detect the exposure is not limited to the circuitdescribed above.

Furthermore, as an alternative to anisotropic conductor 90, othertechniques, such as soldering, a bumping technique using eutecticbonding, may be used to electrically connect terminals 86 a, 86 b, . . .and terminals 88 a, 88 b, . . . together.

Third Embodiment

FIG. 11A is an exploded perspective view of an IC chip module 98 in athird embodiment of the present invention. IC chip module 98 includes anIC chip 94 and a seal member 96 stuck on an upper surface of IC chip 94.The present embodiment differs from IC chip module 92 (shown in FIG.10A) described above in that a CPU, a modulator/demodulator circuit, apower supply generator circuit and other main circuits, and anon-volatile memory are mounted to a single IC chip 94.

IC chip 94 has an upper surface provided with two terminals 94 a and 94b and a pad 95 used to check a non-volatile memory. Seal member 96 isstuck to cover terminals 94 a and 94 b and pad 95. Seal member 96 on itsadhesive side at at least that portion in a strip facing terminals 94 aand 94 b, provides a strip of interconnection 97 formed of a conductivematerial.

FIG. 11B is a circuit diagram of exposure sensor 84 of IC chip module98. The circuit of exposure sensor 84 of the present embodiment issimilar to that shown in FIG. 10B. More specifically, as shown in FIG.11A, terminals 94 a and 94 b provided to IC chip 94 are electricallyconnected together by the strip of interconnection 97 formed on sealmember 96.

Seal member 96 normally stuck on an upper surface of IC chip 94 allowsconduction between two output terminals Ts, as in IC chip module 92described above. Thus the voltage across two output terminals Ts has avalue no more than a threshold. However, when IC chip module 98 isopened or seal member 96 on the upper surface of IC chip 94 is removedto apply a probe or the like on pad 95, conduction fails betweenterminals 94 a and 94 b and the voltage across two output terminals Tshas a value no less than the threshold. As with IC chip module 92described above, the voltage created across two output terminals Ts thathas a value no less than the threshold corresponds to the exposuredetection signal. Receiving the exposure detection signal, the CPU isnotified that IC chip module 98 is in opened condition.

While in the FIGS. 10A and 11A embodiments, disconnection(non-conduction) of an interconnection is detected to detect that an ICchip module is in opened condition, external light entering when the ICchip module is opened may be detected to detect that the module is inopened condition, as is with IC card 30 described above. Furthermore, avariation in electrostatic capacitance introduced when the IC chipmodule is opened may be detected to detect that the module is in openedcondition, or a variation in resistance introduced when the module isopened may be detected to detect that the module is in opened condition.

When the exposure detection signal is received, the CPU incorporated inIC chip 86 (shown in FIG. 10A) or 94 (shown in FIG. 11A) provides aprocessing similar to that with IC card 30 described above, e.g., aprocessing to render the CPU inoperable (FIG. 9).

It should be noted that when a CPU and a non-volatile memory areprovided to a single IC chip, as in IC chip module 98 (shown in FIG.11A), other types of processing can also be provided, such as erasing aportion or the entirety of the data stored in the non-volatile memory(FIG. 7), prohibiting reading a portion or the entirety of the datatherein (FIG. 8).

Although in each embodiment above, the present invention is applied to a1-coil, non-contact IC card, the present invention is also applicable toso-called multi-coil, non-contact IC cards. The present invention isalso applicable to contact IC cards. Furthermore, the present inventionis generally applicable to IC cards with a IC chip mounted thereto. Itshould be noted that an IC card referred to herein is a housing bodywith an IC chip housed therein and may have any shapes and sizes. Thehousing body includes a box-like member, as well as a generallyplate-like member. The present invention is applicable not only to ICcards but also to IC chip modules including a member with an IC chipcircuit.

Industrial Applicability

Thus the present invention allows manufacturing an IC card with enhancedsecurity and is thus advantageously applicable to any industriesmanufacturing and utilizing such IC card.

What is claimed is:
 1. An IC card comprising: an IC chip having a CPU; ahousing body housing said IC chip; and exposure detection means formedat said IC chip, detecting opened condition of said housing body;characterized in that said CPU controls said IC chip to at leastpartially fail to normally function in response to a signal indicativeof the opened condition having been output from said exposure detectionmeans when the CPU receives a power supply voltage to start to operate.2. The IC card of claim 1, said IC chip including a data storage unitdisposed to store data, characterized in that once the opened conditionhas been detected via said signal output said data storage unit has thedata at least partially rendered non-extractable.
 3. The IC card ofclaim 2, characterized in that once the opened condition has beendetected via said signal output said data storage unit has the data atleast partially prohibited from being read.
 4. The IC card of claim 2,characterized in that once the opened condition has been detected viasaid signal output said data storage unit has the data at leastpartially erased.
 5. The IC card of claim 1, said IC chip including adata processing unit disposed to process data, characterized in thatonce the opened condition has been detected via said signal output saiddata processing unit has a function at least partially stopped.
 6. TheIC card of claim 1, characterized in that said exposure detection meansdetects the opened condition by detecting external light entering whensaid housing body is opened.
 7. The IC card of claim 6, characterized inthat said exposure detection means is a plurality of light receivingelements arranged in parallel.
 8. An IC chip module with at least twomembers integrally formed, at least one of said members being providedwith an IC chip having a CPU, comprising exposure detection means formedat said IC chip, detecting opened condition of said IC chip module,characterized in that said CPU controls said IC chip to at leastpartially fail to normally function in response to a signal indicativeof the opened condition having been output from said exposure detectionmeans when the CPU receives a power supply voltage to start to operate.9. The IC chip module of claim 8, said IC chip including a data storageunit disposed to store data, characterized in that once the openedcondition has been detected via said signal output said data storageunit has the data at least partially rendered non-extractable.
 10. TheIC chip module of claim 9, characterized in that once the openedcondition has been detected via said signal output said data storageunit has the data at least prohibited from being read.
 11. The IC chipmodule of claim 9 characterized in that once the opened condition hasbeen detected via said signal output said data storage unit has the dataat least partially erased.
 12. The IC chip module of claim 8, said ICchip including a data processing unit disposed to process data,characterized in that once the opened condition has been detected viasaid signal output said data processing unit has a function at leastpartially stopped.
 13. The IC chip module of claim 8, characterized inthat said exposure detection means detects the opened condition bydetecting external light entering when said IC chip module is opened.14. The IC chip module of claim 13, characterized in that said exposuredetection means is a plurality of light receiving elements arranged inparallel.